detectonic.

RUNS IN YOUR BROWSER • NO DATA SENT OUT

Review the logs.
Build the draft.

Check Windows logs locally as JSON and prepare an SPL starting template for your selected event profile.

01 / INPUT

JSON object, array or JSON Lines. Up to 200 KiB / 500 records. Review sensitive fields before sharing real logs.

02 / OUTPUT

LOCAL PROTOTYPE

Field and record review

Results will appear here. Enter your own JSON or load the synthetic sample.

SPL starting draft

Validate your index, sourcetype and field names. This is not a threat verdict or a tested production rule.

Validation notes

Local prototype • Template-based drafting • No Claude API connection